Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible

ВысокийУровень 1Ручная проверкаgcp

Описание

It is recommended that IAM policy on Cloud Storage bucket does not allows anonymous or public access. Allowing anonymous or public access grants permissions to anyone to access bucket content. Such access might not be desired if you are storing any sensitive data. Hence, ensure that anonymous or public access to a bucket is not allowed.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

From Google Cloud Console 1. Go to Storage browser by visiting https://console.cloud.google.com/storage/browser. 2. Click on each bucket name to go to its Bucket details page. 3. Click on the Permissions tab. 4. Ensure that allUsers and allAuthenticatedUsers are not in the Members list. From Google Cloud CLI 1. List all buckets in a project gsutil ls 2. Check the IAM Policy for each bucket: gsutil iam get gs://BUCKET_NAME No role should contain allUsers and/or allAuthenticatedUsers as a member. Using Rest API 1. List all buckets in a project Get https://www.googleapis.com/storage/v1/b?project=<ProjectName> 2. Check the IAM Policy for each bucket GET https://www.googleapis.com/storage/v1/b/<bucketName>/iam No role should contain allUsers and/or allAuthenticatedUsers as a member.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

From Google Cloud Console 1. Go to Storage browser by visiting https://console.cloud.google.com/storage/browser. 2. Click on the bucket name to go to its Bucket details page. 3. Click on the Permissions tab. 4. Click Delete button in front of allUsers and allAuthenticatedUsers to remove that particular role assignment. From Google Cloud CLI Remove allUsers and allAuthenticatedUsers access. gsutil iam ch -d allUsers gs://BUCKET_NAME gsutil iam ch -d allAuthenticatedUsers gs://BUCKET_NAME Prevention: You can prevent Storage buckets from becoming publicly accessible by setting up the Domain restricted sharing organization policy at: https://console.cloud.google.com/iam-admin/orgpolicies/iam- allowedPolicyMemberDomains .

Свойства

Операционные системы: Любая
Теги: access-controlcloudgcp
Источник: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - 5.1 Ensure That Cloud Storage Bucket Is Not Anonymously or Publicly Accessible